Founded in 1807, JohnWiley & Sons is the oldest independent publishing company in

partnership models 100–101
policies 102–103
procedures 102–103
risk committees 101–103
risk functions 97–101
risk mitigation 95–103
three lines of defense model 95–102
operational risks
future directions 232–233
Pillar 1 78–88
RCSA exercises 51–57, 182, 187, 190–191,
199–203
regulatory capital 78–88
risk appetite 38–42, 45–46, 49
risk connectivity 29, 32–33
risk definition and taxonomy 19, 22–26
risk identification 5, 8, 10–11, 29, 32–33
risk monitoring 171–178
risk networks 29, 32–33
scenario analysis 13–18
optimistic controls 109
organization aspects 101–103
ORIC
see
Operational Risk Consortium
ORX
see
Operational Riskdata eXchange
Association
outages 73–74, 226
ownership of risks 95–97, 99–101
own funds 77
Paradise Papers 194
partnership models 100–101
peer-to-peer systems 207–219
people environment influences 123
performance, key risk indicators 144
performance controls 108, 144
personal values 122
physical asset damage 21
physical environment influences 123–124

---

Index
241
platform outages 73–74
policies
project risk management 184–185
risk governance 102–103
pooling expert judgment 67–68
portfolios 183–184
preparation phases, scenario analysis 13–14
preventive controls
key risk indicators 154–155
risk management sequences xxiii
risk management taxonomy 24
risk mitigation 24, 105–106, 110–113,
116–117
primary controls 106
PRINCE 2 181–182
probability of occurrence 51, 53–60, 64–65,
72–74
procedures, operational risk governance 102–103
processes, incident data collection 132–139
process mapping 4, 9
progress assessments 124–125
project risk management 181–192
approvals 182–183
closure 184–185
data aggregation 190
debriefing 184–185
decision-making 181–182
governance 181–182, 185, 192
key risk indicators 192
life cycles 182
policy 184–185
portfolios 183–184
ratings 186–189
RCSA 182, 187, 190–191
risk assessments 181–182, 187–190
risk function 181–187
risk identification 181–182, 187–190
risk mitigation 182
risk monitoring 182, 191–192
risk ratings 186–189
risk reporting 191–192
risk update 182
stage-gate processes 181–182
propinquity 123–124
pyramid structures 46–47
QIS
see
quantitative impact studies
quality assessments 172
quality reviews 137
quantification details 73–74
quantitative impact studies (QIS) 80
quartiles 168
questionnaires 199–201
rare data losses 166–167
RCSA
see
risk and control self-assessments
reconciling, risk identification tools 5
regulations, incident data collection 129–132,
136–137
regulatory capital
advanced measurements 81–85
banks 77–92
Basel II 77–92
BEICF 84
calculation datasets 82–83
CCAR process 88–91
control factors 84
external data 83–85
frequency assessments 87
history 77–79
ICAAP 88–91
internal databases 82–83
losses 77–92
modeling 77–92
Monte Carlo simulations 87
operational risks 78–88
Pillar 1 78–88
Pillar 2 78, 88–92
rationale 77–79
risk assessments 77–92
scenario analysis 63–65, 72–73, 84–86, 89–92
severity assessments 87
standardized measurement 79–81
stochastic models 85
stress testing 90–92
supervisory reviews 78, 88–92
units of measure 88
wind-down planning 92
regulatory compliance 157, 173–174
reperformance controls 108
repetitive controls 109–110
reputation 221–229
benefits 224

---

242
INDEX
reputation (